skip to content

Search
Syspirit
EN

➤OpenSSL

SSL/TLS certificate management with OpenSSL - generation, conversion, verification and debugging!

Security
Published on
Karl Certa
#openssl #ssl #tls #certificates #security #cryptography

OpenSSL is the reference toolkit for SSL/TLS certificate management, encryption, and cryptographic operations. Available on Linux, Windows, and macOS.

🔍 Certificate Verification

📌 Action🧠 Command
📜 Display PEM certificateopenssl x509 -in cert.pem -text -noout
📜 Display DER certificateopenssl x509 -in cert.cer -inform DER -text -noout
🔑 Verify private keyopenssl rsa -in key.pem -check
📝 Display CSRopenssl req -in request.csr -text -noout
📦 Verify PFXopenssl pkcs12 -in cert.pfx -info -noout
📅 Validity datesopenssl x509 -in cert.pem -noout -dates
🏷️ View subjectopenssl x509 -in cert.pem -noout -subject
🏢 View issueropenssl x509 -in cert.pem -noout -issuer
🔢 Serial numberopenssl x509 -in cert.pem -noout -serial

🔄 Format Conversions

PEM ↔ DER

# PEM to DER
openssl x509 -in cert.pem -outform DER -out cert.der
 
# DER to PEM
openssl x509 -in cert.der -inform DER -out cert.pem

PEM ↔ PFX/P12

# PEM to PFX (certificate + key + chain)
openssl pkcs12 -export -out cert.pfx \
  -inkey private.key \
  -in cert.pem \
  -certfile chain.pem
 
# PFX to PEM (extract everything)
openssl pkcs12 -in cert.pfx -out all.pem -nodes
 
# PFX to PEM (certificate only)
openssl pkcs12 -in cert.pfx -clcerts -nokeys -out cert.pem
 
# PFX to PEM (key only)
openssl pkcs12 -in cert.pfx -nocerts -nodes -out key.pem

RSA Keys

# Encrypted to unencrypted key
openssl rsa -in encrypted.key -out decrypted.key
 
# Unencrypted to encrypted key
openssl rsa -in key.pem -aes256 -out encrypted.key

🔑 Key and CSR Generation

📌 Action🧠 Command
🔑 Generate RSA 2048 keyopenssl genrsa -out key.pem 2048
🔑 Generate RSA 4096 keyopenssl genrsa -out key.pem 4096
🔐 Encrypted RSA keyopenssl genrsa -aes256 -out key.pem 2048
📝 Generate CSRopenssl req -new -key key.pem -out request.csr
⚡ Key + CSR in one commandopenssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out request.csr

CSR with SAN (Subject Alternative Names)

# Create a san.cnf config file
cat > san.cnf << EOF
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
 
[req_distinguished_name]
CN = example.com
 
[v3_req]
subjectAltName = @alt_names
 
[alt_names]
DNS.1 = example.com
DNS.2 = www.example.com
DNS.3 = api.example.com
EOF
 
# Generate CSR with SAN
openssl req -new -key key.pem -out request.csr -config san.cnf

📜 Self-Signed Certificates

# Simple self-signed certificate (1 year)
openssl req -x509 -nodes -days 365 \
  -newkey rsa:2048 \
  -keyout key.pem \
  -out cert.pem \
  -subj "/CN=example.com"
 
# Self-signed certificate with SAN
openssl req -x509 -nodes -days 365 \
  -newkey rsa:2048 \
  -keyout key.pem \
  -out cert.pem \
  -config san.cnf \
  -extensions v3_req

🌐 Debug SSL/TLS Connections

📌 Action🧠 Command
🔗 Test HTTPS connectionopenssl s_client -connect example.com:443
📜 Display certificateopenssl s_client -connect example.com:443 -showcerts
🔒 Force TLS 1.2openssl s_client -connect example.com:443 -tls1_2
🔒 Force TLS 1.3openssl s_client -connect example.com:443 -tls1_3
📧 Test SMTP STARTTLSopenssl s_client -connect mail.example.com:587 -starttls smtp
📧 Test IMAP STARTTLSopenssl s_client -connect mail.example.com:143 -starttls imap
🗄️ Test MySQL/MariaDB SSLopenssl s_client -connect db.example.com:3306 -starttls mysql

Retrieve Server Certificate

# Download the certificate
echo | openssl s_client -connect example.com:443 2>/dev/null | \
  openssl x509 -out server-cert.pem
 
# Download the full chain
echo | openssl s_client -connect example.com:443 -showcerts 2>/dev/null | \
  sed -n '/-----BEGIN/,/-----END/p' > chain.pem

✅ Matching Verification

# Verify that key and certificate match
openssl x509 -noout -modulus -in cert.pem | openssl md5
openssl rsa -noout -modulus -in key.pem | openssl md5
# Both hashes must be identical
 
# Verify that CSR and key match
openssl req -noout -modulus -in request.csr | openssl md5
openssl rsa -noout -modulus -in key.pem | openssl md5

🔐 File Encryption

📌 Action🧠 Command
🔒 Encrypt a fileopenssl enc -aes-256-cbc -salt -in file.txt -out file.enc
🔓 Decrypt a fileopenssl enc -d -aes-256-cbc -in file.enc -out file.txt
🔒 Encrypt with pbkdf2openssl enc -aes-256-cbc -salt -pbkdf2 -in file.txt -out file.enc

📊 Hashing and Signatures

📌 Action🧠 Command
#️⃣ MD5 hashopenssl dgst -md5 file.txt
#️⃣ SHA256 hashopenssl dgst -sha256 file.txt
#️⃣ SHA512 hashopenssl dgst -sha512 file.txt
✍️ Sign a fileopenssl dgst -sha256 -sign key.pem -out sig.bin file.txt
✅ Verify signatureopenssl dgst -sha256 -verify pubkey.pem -signature sig.bin file.txt

🏗️ Create a Private CA

1. Create Root CA

# Generate CA key
openssl genrsa -aes256 -out ca-key.pem 4096
 
# Create root certificate (10 years)
openssl req -new -x509 -days 3650 \
  -key ca-key.pem \
  -out ca-cert.pem \
  -subj "/CN=My Private CA/O=My Company"

2. Sign a Certificate with the CA

# Create CSR for the server
openssl req -new -key server-key.pem -out server.csr
 
# Sign with CA (1 year)
openssl x509 -req -days 365 \
  -in server.csr \
  -CA ca-cert.pem \
  -CAkey ca-key.pem \
  -CAcreateserial \
  -out server-cert.pem

🔧 Useful Commands

📌 Action🧠 Command
📋 OpenSSL versionopenssl version
📋 Detailed versionopenssl version -a
🔐 List ciphersopenssl ciphers -v
🎲 Generate passwordopenssl rand -base64 32
🎲 Generate random hexopenssl rand -hex 16
📝 Encode to base64openssl base64 -in file.bin -out file.b64
📝 Decode base64openssl base64 -d -in file.b64 -out file.bin

🛠️ Common Troubleshooting

🆘 Problem🧠 Solution
❌ “unable to load certificate”Check format (PEM vs DER), try -inform DER
❌ “key values mismatch”Key and certificate don’t match
❌ “certificate verify failed”Expired certificate or incomplete chain
❌ “wrong version number”Wrong port or protocol (HTTP instead of HTTPS)
❌ “no peer certificate”Server doesn’t present a certificate
❌ “self signed certificate”CA not recognized, add to trust store